CVE-2026-21962

🚨 CVE-2026-21962 - Critical Authentication Bypass Vulnerability 🧾 Summary 🔥 A maximum severity 10.0 vulnerability enabling unauthenticated remote access to Oracle middleware systems. CVE ID : CVE-2026-21962 Severity : CRITICAL Published : 2026-01-20 Category : Authentication Bypass CWE : CWE-284...

Log4j_dos_CVE-2021-45105

Log4j2 DOS CVE-2021-45105 Poc $$::-$::-$$::-$ Versions Affected: all versions from 2.0-beta9 to 2.16.0 This application is based on Spring Boot web application vulnerable to CVE-2021-45105 It uses Log4j 2.16.0 Running the application Run it: Import the project in Java IDE as a maven project Run...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

BrokenType

BrokenType BrokenType is a set of tools designed to test the robustness and security of font rasterization software, especially codebases prone to memory corruption issues written in C/C++ and similar languages. It consists of the following components: TrueType program generator - a Python script...

PunchingBag-for-React2Shell

🥊 PunchingBag - CVE-2025-55182 Security Research Platform ⚠️ EDUCATIONAL PURPOSE ONLY : This is an intentionally vulnerable application designed for authorized security research and CTF challenges. Do NOT use these techniques on unauthorized systems. A deliberately vulnerable Next.js 15.1.6...

cve-2021-22005-exp

cve-2021-22005-exp 0x01 Vulnerability Overview On September 21, 2021, VMware released a security advisory disclosing 19 security vulnerabilities in vCenter Server, with CVSSv3 scores ranging from 4.3 to 9.8. Among them, the most critical vulnerability is an arbitrary file upload vulnerability in...

CVE-2026-24061-NSE

CVE-2026-24061 — GNU InetUtils telnetd Authentication Bypass Nmap NSE Detection Script Overview This Nmap NSE script detects CVE-2026-24061 , an authentication bypass vulnerability in GNU InetUtils telnetd versions 1.9.3 through 2.7. By sending a crafted USER environment variable of the form -f...

LAB1-metasploitable

LAB1-metasploitable Exploitation des vulnérabilités sur la version vsftpd 2.3.4 du service ftp CVE-2011-2523 Exploit Title: vsftpd 2.3.4 - Backdoor Command Execution Date: 9-04-2021 Exploit Author: HerculesRD Software Link: http://www.linuxfromscratch.org/thomasp/blfs-book-xsl/server/vsftpd.html...

AFD

AFD CVE-2022-24494 The vulnerability is an arbitrary memory read. The root cause is a lack of validation in a memory address suplied from user-land that is used in a memcpy operation in order to copy data from this memory address into the pool memory. The lack of check is in the addres...

nexts-cve-2025-66478-exploit

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...

CVE-2025-29632

Author: HanyiLuo, Yuqi Huo CVE-2025-29632 the information for the vulnerability covered by CVE-2025-29632 Affected versions: 4.0.0 and previous versions When free5gc processes the InitialUEMessage, it only checks whether the nASPDU reference is nil i.e., whether it is a null pointer, but does not...

wesng

Windows Exploit Suggester - Next Generation WES-NG WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 11, includin...

CVE-2026-9055

CVE-2026-9055 — Amelia Booking Plugin Unauthenticated Privilege Escalation Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here for this vulnerability. An unauthenticated privilege escalation vulnerability in the Amelia Premium WordPress...

CVE-2025-22954

Koha CVE-2025-22954: SQL Injection in lateissues-export.pl Overview This repository contains a proof of concept for CVE-2025-22954, a critical severity CVSS 10.0 SQL injection vulnerability in Koha before version 24.11.02. The vulnerability exists in the GetLateOrMissingIssues function in...

CVE-2022-22978-PoC

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I have gathered, this vulnerability is related to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...

lempo

Lempo: LDAP Exposure on POrtainer CVE-2018-19466 | Mauro Eldritch AKA plaguedoktor ./lempo.rb TARGETIP TARGETUSER TARGETPASSWORD This exploit is a complement to my talk Hacking Docker with PAZUZU. Presentations | Date| Conference| Link to Video| Link to Slides ---|---|---|---|--- 1| NOV-2018|...

CVE-2025-55182-Metasploit-exploit-skeleton-real-flow-

🧪 STEP 1: Demo vulnerable web-app LAB We create logic similar to CVE-2025-55182 unsafe server-side execution. 📁 vulnapp/app.py from flask import Flask, request import subprocess app = Flaskname @app.route"/render", methods="POST" def render: data = request.json.get"component" ❌ VULNERABLE: user...

CVE-2024-5084

Hash Form 9.9.1 file upload vulnerability Exploit The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for...

CVE-2021-44228

CVE-2021-44228 Apache Log4j Remote Code Execution） all log4j-core versions =2.0-beta9 and =2.14.1 The version of 1.x has other vulnerabilities, it is recommended to update to the latest version. Security Advisories / Bulletins linked to Log4Shell CVE-2021-44228 Usage: Download this project, compi...

CitrixBleed-2-CVE-2025-5777-PoC-

CitrixBleed 2 CVE-2025-5777 Ultimate Analysis An Out-of-Bounds Memory Read in NetScaler ADC / Gateway — A Comprehensive Guide from Root Cause to Offensive and Defensive Exercises poc usage: python3 poc.py https://gateway.example.com exp usage: python3 exp.py https://gateway.example.com admin...